rocketmq_auth/authentication/
builder.rs

1// Copyright 2023 The RocketMQ Rust Authors
2//
3// Licensed under the Apache License, Version 2.0 (the "License");
4// you may not use this file except in compliance with the License.
5// You may obtain a copy of the License at
6//
7//     http://www.apache.org/licenses/LICENSE-2.0
8//
9// Unless required by applicable law or agreed to in writing, software
10// distributed under the License is distributed on an "AS IS" BASIS,
11// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12// See the License for the specific language governing permissions and
13// limitations under the License.
14
15//! Authentication context builder module.
16//!
17//! This module provides traits and implementations for building authentication contexts
18//! from various request sources (gRPC metadata, Remoting commands, etc.).
19
20pub mod default_authentication_context_builder;
21
22pub use default_authentication_context_builder::DefaultAuthenticationContextBuilder;
23use rocketmq_protocol::protocol::remoting_command::RemotingCommand;
24
25use crate::AuthServiceResult;
26
27/// Authentication context builder trait.
28///
29/// This trait defines the interface for building authentication contexts from different
30/// request sources. Implementations should extract authentication credentials (AccessKey,
31/// Signature, etc.) from the request and construct an appropriate authentication context.
32///
33/// # Type Parameters
34///
35/// * `Context` - The type of authentication context to build
36///
37/// # Examples
38///
39/// ```rust,ignore
40/// use rocketmq_auth::AuthenticationContextBuilder;
41///
42/// let builder = DefaultAuthenticationContextBuilder::new();
43/// let context = builder.build_from_remoting(channel_context, &request)?;
44/// ```
45pub trait AuthenticationContextBuilder<Context> {
46    /// Build an authentication context from a gRPC request.
47    ///
48    /// Extracts authentication information from gRPC metadata headers including:
49    /// - Authorization header (contains Credential and Signature)
50    /// - DateTime header (used as signed content)
51    /// - Channel ID
52    ///
53    /// # Arguments
54    ///
55    /// * `metadata` - gRPC metadata containing authentication headers
56    /// * `request` - The gRPC request message
57    ///
58    /// # Returns
59    ///
60    /// * `Ok(Context)` - Successfully built authentication context
61    /// * `Err(AuthServiceError)` - Failed to parse or validate authentication data
62    ///
63    /// # Errors
64    ///
65    /// - Missing or invalid DateTime header
66    /// - Malformed Authorization header
67    /// - Invalid credential format
68    #[cfg(feature = "grpc")]
69    fn build_from_grpc(
70        &self,
71        metadata: &tonic::metadata::MetadataMap,
72        request: &dyn std::any::Any,
73    ) -> AuthServiceResult<Context>;
74
75    /// Build an authentication context from a Remoting command.
76    ///
77    /// Extracts authentication information from RemotingCommand extFields including:
78    /// - AccessKey field
79    /// - Signature field
80    /// - All other fields (combined as signed content)
81    ///
82    /// # Arguments
83    ///
84    /// * `channel_context` - The channel handler context (provides channel ID)
85    /// * `request` - The remoting command request
86    ///
87    /// # Returns
88    ///
89    /// * `Ok(Context)` - Successfully built authentication context
90    /// * `Err(AuthServiceError)` - Failed to extract authentication data
91    ///
92    /// # Security Notes
93    ///
94    /// - Filters out UNIQUE_MSG_QUERY_FLAG for versions <= 4.9.3
95    /// - Excludes Signature field from signed content
96    /// - Sorts fields for consistent signature verification
97    fn build_from_remoting(&self, request: &RemotingCommand, channel_id: Option<&str>) -> AuthServiceResult<Context>;
98}
rocketmq_auth/authentication/builder.rs

rocketmq_auth/authentication/
builder.rs
